A few additional comments:
* "or alternatively the application can include an id_token_hint with the
request that proves the application does not need consent from the user"
I understand that ID Tokens should be short-lived, but aren't we setting
the exp of ID tokens with the value from access tokens? See
In addition to that, I don't think that using a front-channel to pass
tokens is something we want to do given that there are a lot of
considerations around this approach. If we are really going this way, I
think we should at least consider some form of proof-of-possession.
For last, maybe you should explicitly mention the usage of TLS?
On Wed, Mar 27, 2019 at 9:43 PM Stian Thorgersen <sthorger(a)redhat.com>
Based on feedback and also thinking about this a bit more I've
the proposal for Application Initiated Actions.
Please read and comment on the update draft if you're interested.
keycloak-dev mailing list